Mix-net system

ABSTRACT

Each participant apparatus ( 103 ) encrypts a plaintext by using a secret key of secret key cryptography, encrypts the encryption key by a public key, and sends the plaintext and public key to a substitution/decryption apparatus ( 112 ). With this processing, the limitation on the length of a ciphertext to be processed can be eliminated. In this invention, a verifiable proof text using a public key by each substitution/decryption apparatus is verified by a verification apparatus ( 109 ) by using the public key. If one of a plurality of organizations to decrypt and shuffle ciphertexts has not correctly executed the operation, a third party can specify it and prove that the specified organization is unauthorized.

TECHNICAL FIELD

The present invention relates to a mix-net technology of causing aplurality of organizations to, in cooperation with each other, shuffleand decrypt a plurality of input ciphertexts and output data whosecorrespondence with the input ciphertexts is unnoticeable and, moreparticularly, to a technique of eliminating the limitation on the lengthof an input ciphertext and, if one of a plurality of organizations hasnot executed the correct operation, allowing even a third party tospecify it and prove that fact.

BACKGROUND ART

Mix-net is an operation of substituting and decrypting the elements ofan input ciphertext sequence such that the correspondence between theelements of an output decrypted text sequence and those of the inputciphertext sequence becomes unnoticeable.

[Prior Art (1)]

In a conventional mix-net, a method using a proof apparatus and averification apparatus is used to make it possible to specify anorganization which has not executed the correct operation and specifythe fact (e.g., Japanese Patent Laid-Open No. 2002-344445 (reference1)). This method will be described with reference to FIG. 8.

The proof apparatus of reference 1 proves that substitution anddecryption are correctly done. The verification apparatus of reference 1verifies that the proof executed by the proof apparatus is correct. Withthe functions of the two apparatuses, if the proof apparatus does notexecute the correct operation (substitution and decryption), prooffails, and the verification apparatus can determine that the proofapparatus has not correctly operated.

The proof apparatus and verification apparatus of reference 1 are usedin the following way and operated as a mix-net as a whole. First, aprivate key 906 is determined in correspondence with eachsubstitution/decryption apparatus 912. A public key 901 is generatedfrom the private key 906 and distributed to all participant apparatuses903. Each participant apparatus 903 encrypts a short plaintext 902having a predetermined length by using the public key 901.

Each substitution/decryption apparatus 912 substitutes and decrypts aninput ciphertext sequence 913 and transfers it to the nextsubstitution/decryption apparatus 912 (processing 907). This operationis repeated to finally obtain a plaintext sequence 911. Thesubstitution/decryption apparatus 912 proves by using the proofapparatus of reference 1 that the substitution and decryption operationsexecuted by itself are correct (processing 908). A verificationapparatus 909 verifies, by using the verification apparatus of reference1, the proof executed by the substitution/decryption apparatus. Even athird party can execute this verification when it can prepare theverification apparatus.

In the above method, the length of the plaintext 902 that theparticipant apparatus 903 can encrypt is limited to almost the same asthe length of the public key. Hence, a longer plaintext cannot beprocessed.

[Prior Art (2)]

In another conventional mix-net, a method by Juels and Jakobsson is usedto make it possible to process a ciphertext having an arbitrary length(e.g., “An Optimally Robust Hybrid Mix Network, Proc. of the 20th annualACM Symposium on Principles of Distributed Computation, 2001” (reference2)). In this method, a ciphertext to be input is created by encrypting aplaintext by arbitrary secret key cryptography. Hence, the length of theplaintext is not particularly limited. Additionally, in this method, ifone of a plurality of organizations to decrypt and shuffle ciphertextshas not correctly executed these operations, it can be specified by theorganizations which execute ,encryption and shuffle in cooperation.However, a third party not in cooperation with the plurality oforganizations cannot specify the organization which has not correctlyexecute the ciphertext operation.

The above relationship will be described with reference to FIG. 9. Themix-net of reference 2 operates in almost the same way as the mix-net ofthe prior art (1) except that a long plaintext 1002 may be input. Inaddition, the substitution/decryption apparatuses can verify each otherwhether substitution and decryption have been done correctly (processing1014). However, any third party cannot verify it, unlike the prior art(1).

DISCLOSURE OF INVENTION Problems to be Solved by the Invention

In the prior art (1), if one of a plurality of organizations to decryptand shuffle ciphertexts has not correctly executed these operations, athird party can specify it and prove that the specified organization isunauthorized. On the other hand, this method has a problem that theprocessible length of a ciphertext is limited.

In the prior art (2), the processible length of a ciphertext is notlimited. However, there is a problem that if one of a plurality oforganizations to decrypt and shuffle ciphertexts has not correctlyexecuted these operations, any third party can specify it by itself.

It is an object of the present invention to allow a third party tospecify an unauthorized organization when decryption and shuffle ofciphertexts are done by a plurality of organizations.

It is another object of the present invention to eliminate thelimitation on the length of a ciphertext.

Means of Solution to the Problems

A participant apparatus according to the present invention ischaracterized by comprising:

key encryption means for encrypting one of a plurality of secret keys ofsecret key cryptography by one public key of a plurality ofsubstitution/decryption apparatuses;

data encryption means for encrypting given data by one of the pluralityof secret keys of the secret key cryptography;

hash value encryption means for calculating a hash value of the givendata by using a cryptographic hash function and encrypting the hashvalue by one public key of the plurality of substitution/decryptionapparatuses;

repeat means for repeating processing of inputting a plaintext as afirst input to the data encryption means and inputting, as subsequentinputs to the data encryption means, preceding outputs from the dataencryption means, the key encryption means, and the hash valueencryption means a number of times equal to the number ofsubstitution/decryption apparatuses; and

output means for outputting data obtained by processing of the repeatmeans.

A consolidating apparatus according to the present invention ischaracterized by comprising an arrangement which receives a plurality ofdata, verifies authenticity of each of the data, and outputs only datawhich is determined as authentic.

A substitution/decryption apparatus according to the present inventionis characterized by comprising:

data division means for diving each element of an input data sequenceinto a secret key of secret key cryptography, which is encrypted bypublic key cryptography, data encrypted by secret key cryptography, anda hash value encrypted by public key cryptography;

secret key decryption means for decrypting the encrypted secret key ofthe secret key cryptography by a private key of the public keycryptography;

data decryption means for decrypting the encrypted data by using thedecrypted secret key to generate output data;

hash value decryption means for outputting a value obtained bydecrypting the encrypted hash value by the private key of the public keycryptography;

hash value verification means for comparing the decrypted hash valuewith a hash value of the generated output data, if the values coincide,outputting hash value acceptance, and if the values do not coincide,outputting hash value unacceptance;

output data sequence generation means for generating a data sequencewhich contains, as sequence elements, only the output data for whichacceptance is output from the hash value verification means and whichare corresponding in a sense of being generated from the same elementdata of the input data sequence, and uniformly shuffling the elements atrandom to form an output data sequence;

hash value decryption authenticity proof means for generating a hashvalue decryption authenticity proof text as a proof text which provesthat the hash value of each element of the output data sequence isalways a value obtained by decrypting the encrypted hash value containedin a certain element of the input data sequence, and the hash values arein a one-to-one correspondence;

hash value unacceptance authenticity proof means for generating a hashvalue unacceptance authenticity proof text as a proof text which proves,when the hash value verification means outputs unacceptance, that theoutput of unacceptance is authentic; and

output means for creating an authenticity proof text from the hash valuedecryption authenticity proof text and the hash value unacceptanceauthenticity proof text and outputting the authenticity proof text andthe output data sequence output from the output data sequence generationmeans.

A verification apparatus according to the present invention ischaracterized by comprising:

hash value decryption authenticity verification means for verifying thata decrypted hash value contained in a hash value decryption authenticityproof text coincides with a hash value obtained by decrypting anencrypted hash value of a certain element of an input data sequence, andthe hash values are in a one-to-one correspondence, if the hash valuescoincide and are in the one-to-one correspondence, outputtingacceptance, and if the hash values are not in the one-to-onecorrespondence, outputting unacceptance;

hash value coincidence verification means for, when the decrypted hashvalue coincides with a hash value of each element of an output datasequence, outputting acceptance, and if the hash values do not coincide,outputting unacceptance;

hash value unacceptance authenticity verification means for verifying ahash value unacceptance authenticity proof text as a proof text whichproves that for an element of the elements of the input data sequence,which corresponds to a hash value for which the hash value coincidenceverification means outputs unacceptance, the output of unacceptance isauthentic, if the proof text is authentic, outputting acceptance, and ifthe proof text is unauthentic, outputting unacceptance; and

authenticity determination means for outputting acceptance, for theelement of the input data sequence, if the hash value decryptionauthenticity verification means outputs acceptance while the hash valuecoincidence verification means outputs acceptance, or if the hash valuecoincidence verification means outputs unacceptance while the hash valueunacceptance authenticity verification means outputs acceptance, and ifthe output data sequence contains only data corresponding to theelements accepted by the hash value coincidence verification means andall the data, and otherwise, outputting unacceptance.

A mix-net system according to the present invention is characterized bycomprising the plurality of participant apparatuses, the consolidatingapparatus, the substitution/decryption apparatuses, and the verificationapparatus, the system executing

initial setting processing of generating and publishing a safetyvariable, an area variable of the public key cryptography, thecryptographic hash function, and an encryption function of the secretkey cryptography,

initial setting processing of generating and publishing the public keyof each of the plurality of substitution/decryption apparatuses,

participation processing of inputting, to each of the participantapparatuses, the safety variable, the area variable of the public keycryptography, the cryptographic hash function, the encryption functionof the secret key cryptography, the public key of each of the pluralityof substitution/decryption apparatuses, a plurality of secret keys ofthe secret key cryptography, and a plaintext which is different for eachparticipant, and

causing each of the participant apparatuses to output data to be inputto the substitution/decryption apparatuses,

consolidation processing of inputting all the data to be input to thesubstitution/decryption apparatuses, which are obtained by theparticipation processing, to the consolidating apparatus and inputtingan output from the consolidating apparatus as the input data sequence,

substitution/decryption processing of inputting the input data sequenceand the private key of the public key cryptography to one of thesubstitution/decryption apparatuses and causing thesubstitution/decryption apparatus to output the output data sequence anda sequence of an authenticity proof text,

integrated substitution/decryption processing of repeatedly executingthe substitution/decryption processing while exchanging thesubstitution/decryption apparatus to be used by inputting an input datasequence as an output of the consolidation processing as a first inputdata sequence, in which an input data sequence in firstsubstitution/decryption processing is an input data sequence output fromthe consolidation processing, an input data sequence in subsequentsubstitution/decryption processing is an output data sequence ofimmediately preceding substitution/decryption processing, an output datasequence output from final substitution/decryption processing is adecryption result, an output data sequence output from eachsubstitution/decryption processing except the finalsubstitution/decryption processing is an in-progress decryption result,the authenticity proof texts output from all the substitution/decryptionprocessing operations are defined as a global authenticity proof text,and the decryption result, the in-progress decryption results, and theglobal authenticity proof text are output,

verification processing of separating an input and output of eachsubstitution/decryption apparatus from the decryption result, thein-progress decryption results, and the global authenticity proof text,inputting the input data sequence, the output data sequence, and theauthenticity proof text of each substitution/decryption processing tothe verification apparatus, and causing the verification apparatus tooutput one of acceptance and unacceptance, and

mix-net determination processing of collecting outputs of theverification processing for all substitution/decryption processingoperations, if all results indicate acceptance, outputting acceptance,and otherwise, outputting unacceptance.

EFFECT OF THE INVENTION

In the present invention, each participant apparatus encrypts aplaintext by using a secret key of secret key cryptography, encrypts theencryption key by a public key, and sends the plaintext and public keyto a substitution/decryption apparatus. With this processing, thelimitation on the length of a ciphertext to be processed can beeliminated.

In the present invention, a verifiable proof text using a public key byeach substitution/decryption apparatus is verified by a verificationapparatus using the public key. If one of a plurality of organizationsto decrypt and shuffle ciphertexts has not correctly executed theoperation, a third party can specify it and prove that the specifiedorganization is unauthorized.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram showing the overall arrangement of a mix-netsystem according to the present invention;

FIG. 2 is a block diagram showing an arrangement example of aparticipant apparatus according to the first embodiment of the presentinvention;

FIG. 3 is a block diagram showing an arrangement example of asubstitution/decryption apparatus according to the first embodiment ofthe present invention;

FIG. 4 is a block diagram showing an arrangement example of averification apparatus according to the first embodiment of the presentinvention;

FIG. 5 is a block diagram showing an arrangement example of aparticipant apparatus according to the second embodiment of the presentinvention;

FIG. 6 is a block diagram showing an arrangement example of asubstitution/decryption apparatus according to the second embodiment ofthe present invention;

FIG. 7 is a block diagram showing an arrangement example of averification apparatus according to the second embodiment of the presentinvention;

FIG. 8 is a block diagram for explaining the prior art (1); and

FIG. 9 is a block diagram for explaining the prior art (2).

BEST MODE FOR CARRYING OUT THE INVENTION

The embodiments of the present invention will be described next indetail with reference to the accompanying drawings.

First Embodiment 1.1 Outline

The outline of the first embodiment will be described with reference toFIGS. 1 to 4.

As shown in FIG. 1, a mix-net system according to this embodimentincludes a plurality of participant apparatuses 103, a consolidatingapparatus 104, a plurality to substitution/decryption apparatuses 112,and a verification apparatus 109.

[Participant Apparatus]

As shown in FIG. 2, the participant apparatus 103 has a key encryptionmeans 205, data encryption means 206, hash value encryption means 207,knowledge concatenation means 208, repeat means 213, random numberknowledge proof means 210, and output means 215.

The key encryption means 205 encrypts one of a plurality of secret keysof secret key cryptography by using one public key 101 of the pluralityof substitution/decryption apparatuses 112. The key encryption means 205also generates a proof text of knowledge of the secret key encrypted atthis time. The data encryption means 206 encrypts given data 214 byusing one of the plurality of secret keys of secret key cryptography.The hash value encryption means 207 calculates the hash value of thegiven data by using a cryptographic hash function and encrypts the hashvalue by using one public key of the plurality ofsubstitution/decryption apparatuses 112. The knowledge concatenationmeans 208 encrypts the given data 214 by using the public key 101 of theplurality of substitution/decryption apparatuses 112. The knowledgeconcatenation means 208 also generates a proof text of knowledge of asecret random number used for encryption at this time.

The repeat means 213 repeats processing of inputting a plaintext 102 asthe first input to the data encryption means 206 and inputting, assubsequent inputs to the data encryption means 206, preceding outputsfrom the data encryption means 206, key encryption means 205, hash valueencryption means 207, and knowledge concatenation means 208 a number oftimes equal to the number of substitution/decryption apparatuses 112.The whole random number knowledge proof means 210 generates and outputsa proof text of knowledge of the sum of secret random numbers used inall the repeated processing operations for data finally obtained byrepeating the processing by the knowledge concatenation means 208. Theoutput means 215 outputs, as a ciphertext 211, data obtained by theprocessing of the repeat means 213. The output means 215 also outputsdata to prove that an authentic participant apparatus has created theciphertext 211.

[Consolidating Apparatus]

The consolidating apparatus 104 receives, from each of the plurality ofparticipant apparatuses 103, the ciphertext 211 and the data to provethat an authentic participant apparatus has created the ciphertext 211.The consolidating apparatus 104 verifies that the input ciphertext 211has been generated by an authentic participant apparatus and outputsonly ciphertexts determined as authentic to one of thesubstitution/decryption apparatuses 112.

[Substitution/Decryption Apparatus]

As shown in FIG. 3, the substitution/decryption apparatus 112 has a datadivision means 322, secret key knowledge verification means 307, secretrandom number knowledge verification means 308, secret key decryptionmeans 310, data decryption means 313, hash value decryption means 312,hash value verification means 317, concatenated data decryption means314, output data sequence generation means 311, hash value decryptionauthenticity proof means 315, concatenated data decryption authenticityproof means 316, hash value unacceptance authenticity proof means 318,and output means.

The data division means 322 divides each element of an input datasequence 105 input from the consolidating apparatus 104 or anothersubstitution/decryption apparatus into a secret key 302 of secret keycryptography, which is encrypted by public key cryptography, data 303encrypted by secret key cryptography, a hash value 304 encrypted bypublic key cryptography, concatenated data 305 encrypted by public keycryptography, a proof text 301 of knowledge of the encrypted secret key,and a proof text 306 of knowledge of secret random numbers used toencrypt concatenated data.

The secret key knowledge verification means 307 verifies theauthenticity of the proof text 301 of knowledge of the secret key. Ifthe proof text 301 is authentic, acceptance is output. Otherwise,unacceptance is output. The secret random number knowledge verificationmeans 308 verifies the authenticity of the proof text 306 of knowledgeof the secret random number. If the proof text 306 is authentic,acceptance is output. Otherwise, unacceptance is output. The secret keydecryption means 310 decrypts the encrypted secret key of secret keycryptography by using a private key 106 of public key cryptography. Thedata decryption means 313 decrypts the encrypted data 303 by using thedecrypted secret key to generate output data. The hash value decryptionmeans 312 outputs a hash value obtained by decrypting the encrypted hashvalue 304 by using the private key 106 of public key cryptography. Thehash value verification means 317 compares the decrypted hash value withthe hash value of the generated output data. If the values coincide,hash value acceptance is output. If the values do not coincide, hashvalue unacceptance is output. The concatenated data decryption means 314decrypts the encrypted concatenated data 305 by using the private key ofpublic key cryptography.

The output data sequence generation means 311 generates a data sequencewhich contains, as sequence elements, only output data and decryptedconcatenated data for which acceptance is output from all of the hashvalue verification means 317, secret key knowledge verification means307, and secret random number knowledge verification means 306 and whichare corresponding in a sense of being generated from the same elementdata of the input data sequence 105. The output data sequence generationmeans 311 also uniformly shuffles the elements at random to form anoutput data sequence 107.

The hash value decryption authenticity proof means 315 generates a hashvalue decryption authenticity proof text which proves that the hashvalue of each element of the output data sequence 107 is always a valueobtained by decrypting an encrypted hash value contained in a certainelement of the input data sequence 105, and the hash values are in aone-to-one correspondence. The concatenated data decryption authenticityproof means 316 generates a concatenated data decryption authenticityproof text which proves that the decrypted concatenated data containedin each element of the output data sequence 107 is always data obtainedby decrypting encrypted concatenated data contained in a certain elementof the input data sequence 105, and the concatenated data are in aone-to-one correspondence. The hash value unacceptance authenticityproof means 318 generates a hash value unacceptance authenticity prooftext which proves that output of unacceptance from the hash valueverification means 317 is authentic.

The output means creates an authenticity proof text 108 from the hashvalue decryption authenticity proof text, concatenated data decryptionauthenticity proof text, and hash value unacceptance authenticity prooftext and outputs the authenticity proof text 108 and the output datasequence 107 output from the output data sequence generation means 311.

[Verification Apparatus]

As shown in FIG. 4, the verification apparatus 109 has a secret keyknowledge verification means 402, secret random number knowledgeverification means 404, hash value decryption authenticity verificationmeans 406, hash value coincidence verification means 408, concatenateddata decryption authenticity verification means 407, hash valueunacceptance authenticity verification means 409, and authenticitydetermination means 405.

The secret key knowledge verification means 402 verifies theauthenticity of the secret key knowledge proof text 301 belonging toeach element of the input data sequence 105 input from the consolidatingapparatus 104 or substitution/decryption apparatus 112. If the prooftext 301 is authentic, acceptance is output. Otherwise, unacceptance isoutput. The secret random number knowledge verification means 404verifies the secret random number knowledge proof text 306 belonging toeach element of the input data sequence 105. If the proof text 306 isauthentic, acceptance is output. Otherwise, unacceptance is output. Thehash value decryption authenticity verification means 406 verifieswhether the decrypted hash value contained in a hash value decryptionauthenticity proof text 401 coincides with a hash value obtained bydecrypting the encrypted hash value of a certain element of the inputdata sequence 105, and the hash values are in a one-to-onecorrespondence. If the hash values coincide and are in a one-to-onecorrespondence, acceptance is output. Otherwise, unacceptance is output.

The hash value coincidence verification means 408 outputs acceptancewhen the decrypted hash value coincides with the hash value of eachelement of the output data sequence 107 from the substitution/decryptionapparatus 112. Otherwise, unacceptance is output. The concatenated datadecryption authenticity verification means 407 verifies whetherdecrypted concatenated data contained in each element of the output datasequence 107 coincides with data obtained by decrypting the encryptedconcatenated data 305 contained in a certain element of the input datasequence 105, and the concatenated data are in a one-to-onecorrespondence. If the concatenated data coincide and are in aone-to-one correspondence, acceptance is output. Otherwise, unacceptanceis output. For, of the elements of the input ciphertext sequence 303, anelement corresponding to a hash value for which unacceptance is outputfrom the hash value coincidence verification means 408, the hash valueunacceptance authenticity verification means 409 verifies a hash valueunacceptance authenticity proof text 400 which proves that the output ofunacceptance is authentic. If the proof text is authentic, acceptance isoutput. Otherwise, unacceptance is output.

For, of the elements of the input data sequence 105, all elements forwhich both the secret key knowledge verification means 402 and thesecret random number knowledge verification means 404 output acceptance,the authenticity determination means 405 outputs acceptance if all thefollowing conditions are satisfied. Otherwise, unacceptance is output.

(A) Both the hash value decryption authenticity verification means 406and the concatenated data decryption authenticity verification means 407output acceptance.(B) The hash value coincidence verification means 408 outputsacceptance, or the hash value coincidence verification means 408 outputsunacceptance while the hash value unacceptance authenticity verificationmeans 409 outputs acceptance.(C) The output data sequence 107 contains only data corresponding to theelements accepted by the secret key knowledge verification means 402,secret random number knowledge verification means 404, and hash valuecoincidence verification means 408 and all these data.

[Operation of Mix-Net System]

First, initial setting processing 100 is executed in which a safetyvariable, an area variable of public key cryptography, a cryptographichash function, and an encryption function of secret key cryptography aregenerated and published. Next, initial setting processing 320 of thesubstitution/decryption apparatus is executed in which the public key ofeach of the plurality of substitution/decryption apparatuses 112 isgenerated and published.

Participation processing is executed then in which each of the pluralityof participant apparatuses 103 receives the safety variable, the areavariable of public key cryptography, the cryptographic hash function,the encryption function of secret key cryptography, the public key ofeach of the plurality of substitution/decryption apparatuses 112, aplurality of secret keys of secret key cryptography, and a plaintextwhich is different for each participant apparatus 103 to generate datato be output to the substitution/decryption apparatuses through theconsolidating apparatus 104. All the data obtained by participationprocessing are input to the consolidating apparatus 104 andconsolidated. The result is output to one of the substitution/decryptionapparatuses 112 as the input data sequence 105.

Next, substitution/decryption processing is executed in which each ofthe substitution/decryption apparatuses 112 receives the input datasequence 105 and the private key 106 of public key cryptography andgenerates the output data sequence 107 and the sequence of theauthenticity proof text 108. At this time, the input data sequence 105input to the first substitution/decryption apparatus 112 is the inputdata sequence 105 output from the consolidating apparatus 104. The inputdata sequence 105 input to each succeeding substitution/decryptionapparatus 112 is the output data sequence 107 output from theimmediately preceding substitution/decryption apparatus 112. The outputdata sequence 107 output from the final substitution/decryptionapparatus 112 is the decryption result. The output data sequence 107output from each substitution/decryption apparatus 112 except the finalsubstitution/decryption apparatus 112 is an in-progress decryptionresult. The authenticity proof texts 108 output from all thesubstitution/decryption apparatuses 112 are defined as a globalauthenticity proof text. The decryption result, in-progress decryptionresults and the global authenticity proof text are output. Theabove-described processing is called integrated substitution/decryptionprocessing.

Verification processing is executed then in which the input and outputof each substitution/decryption apparatus 112 are separated from thedecryption result, in-progress decryption results and the globalauthenticity proof text, the input data sequence 105, output datasequence 107, and authenticity proof text 108 in eachsubstitution/decryption apparatus 112 are input to the verificationapparatus 109, and the verification apparatus 109 outputs acceptance orunacceptance. Mix-net determination processing is executed in which theverification processing results for all substitution/decryptionprocessing operations are collected, if all results indicate acceptance,acceptance is output as the entire system, and otherwise, unacceptanceis output as the entire system.

The participant apparatus 103 can use, as the first input to the hashvalue encryption means 207, a random number, a date/time, or a valueunique to a mix-net session, or data which combines these values, inaddition to the plaintext 102.

1.2 Notation

The notation to be used will be described below. Let Hash( ) be acryptographic hash function, q be a prime number, C be an elliptic curvewith an order q, G be a point on C, enc[e]( ) be an encryption functionof secret key cryptography, and dec[e]( ) be a decryption function. Inthis case, e indicates a secret key to be used for encryption ordecryption. Let L be the number of bits in the range of the hashfunction, and L be the number of bits of a key of an encryption functionof secret key cryptography. The number of bits of q is larger than L byat least 5. L is called a safety variable. Equation X=[x]G representsthat X is an x-fold point of G on the elliptic curve. When the additionsymbol “+” is used for a point on the elliptic curve, it indicates anoperation on the elliptic curve.

The mix-net system of the present invention, which can process aciphertext with an arbitrary length and allows a third party to verifyincludes a plurality of substitution/decryption apparatuses, theparticipant apparatuses of a plurality of mix-net participants, theverification apparatus of a verification organization, and theconsolidating apparatus of a consolidating organization. Let m be thenumber of substitution/decryption apparatuses, n be the number ofparticipant apparatuses, S^((j)) be the jth substitution/decryptionapparatus, and U_(i) be the ith participant apparatus.

Let Ψ be one-to-one mapping from an integral value of L bits to a pointon the elliptic curve C, Φ be surjective mapping from a point on theelliptic curve to an integral value of L bits, and Φ·Ψ be identitymapping. Both Φ and Ψ can be calculated efficiently. A detailed exampleof Φ is mapping which sets e=Φ(E) upon being given a point E and employsL bits from the x-coordinate of the point E. In this case, a detailedexample of Ψ is given the bit sequence e of L bits, sets e in the Llower bits of the x-coordinate of the point on the elliptic curve, andpads predetermined 0 to the remaining bits. It is checked whether apoint having such an x-coordinate is present on C. If no point ispresent, the padding is changed in accordance with predeterminedprocedures, and the processing is executed until such an x-coordinate isfound on C. If a point on C is found, it is defined as Ψ(e). Since the Llower bits of the x-coordinate of the point (Ψ(e)) always continue to bee, Φ·Ψ(e)=e holds obviously, and Φ·Ψ is an identity mapping.

1.3 Detailed Example

The first embodiment will be described in detail with reference to FIGS.1 to 4.

[Initial Setting]

An initial setting organization for initial setting determines andpublishes, by using the initial setting processing 100 implemented by acomputer, a bit length Λ of a plaintext, the safety variable L, theprime number q whose bit length is larger than L by 5, the ellipticcurve C having the order q, the point G on C, a cryptographic hashfunction Hash( )having the output bit length L, secret key cryptographyusing a key with the length L, an encryption function enc[e]( ) anddecryption function dec[e] of the secret key cryptography, a function TOfrom a bit sequence with L bits to a point on C, and mapping Φ( ) from apoint on C to a bit sequence with L bits. The prime number q, theelliptic curve C with the order q, and the point G on C are the areafunctions of the public key cryptography.

[Initial Setting of Substitution/Decryption Apparatus]

All the substitution/decryption apparatuses 112 execute the next initialsetting processing. The initial setting means 320 (FIG. 3) in each ofsubstitution/decryption apparatuses S^((j)) (j=1, . . . , m) uniformlyselects a private key 106 x^((j))εZ/qZ at random and saves the privatekey in the substitution/decryption apparatus S^((j)). In addition, theinitial setting means 320 generates and publishes a public key 101X^((j))=[x^((j)]G.)

The initial setting means 320 in each substitution/decryption apparatusS^((j)) uniformly selects r^((j))εZ/gZ at random and calculates

γ^((j))=Hash(G,[r ^((j))]X^((j)))

α^((j)) =r ^((j)) −γ ^((j)) r ^((j)) mod q

and publishes γ^((j)) and α^((j)) as a zero-knowledge proof text 321 ofknowledge of x^((j)).

[Ciphertext Generation of Participant Apparatus]

For i=1, . . . , n, a participant apparatus 103 U_(i) (FIG. 2)determines a plaintext 102 M_(i) having the bit length Λ. As the firstdata 214, each participant apparatus 103 U_(i) generates data containingc_(i) ^((m+1))=M_(i), T_(i)′^((m=1))=G, and arbitrary data 203 (eachcontaining arbitrary L-bit character strings K_(i) ^((m+1)),K_(i)′^((m+1)), S_(i) ^((m+1)), S_(i)′^((m+1)), and P_(i) ^((m+1)))(processing 200). In addition, for j=1, . . . , m, a key generationmeans 204 uniformly selects elements r[1]_(i) ^((j)), r[2]_(i) ^((j)),r[3]_(i) ^((j)), r[4]_(i) ^((j)), and r[5]_(i) ^((j)) of Z/qZ and apoint E_(i) ^((j)) on C at random.

Then, the key encryption means 205, data encryption means 206, hashvalue encryption means 207, knowledge concatenation means 208, prooftext collection means 209, proof generation means 210, and output means215 execute the following processing 213 repeatedly in the order of j=m,(m−1), . . . , and 1.

As the arbitrary character string, a random number, a number unique to asession, or a date/time is sometimes selected.

When a random number is used, the participant apparatus can confirm thepresence of its plaintext from the final decrypted text set. When anumber unique to a session or a date/time is used, it can be recognizedthat a ciphertext used for another session is not reused.

Encryption Processing by Key Encryption Means 205

To encrypt a secret key e_(i) ^((j)), the key encryption means 205obtains E_(i) ^((j)) which satisfies

e _(i) ^((j))=Φ(E _(i) ^((j)))

and calculates

(K _(i) ^((j)) ,K _(i)′^((j)))=([r[1]_(i) ^((j)) ]X ^((j)) ,r[r[1]_(i)^((j)]) G+E _(i) ^((j)))

The calculation result is input to the output means 215.

Secret Key Knowledge Proof Text Generation Processing by Key EncryptionMeans 205

γ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i) ^((j)),S _(i)′^((j)) ,T _(i) ^((j)) ,T _(i)′^((j)) ,[r[4]_(i) ^((j)) ]X^((j)))

and

α_(i) ^((j)) =r[4]_(i) ^((j))−γ_(i) ^((j)) r[1]_(i) ^((j)) mod q

are calculated, and the results are input to the proof text collectionmeans 209.

Data Encryption Processing by Data Encryption Means 206

e _(i) ^((j))=Φ(E _(i) ^((j)))

and

c _(i) ^((j)) =enc[e _(i) ^((j))](K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c_(i) ^((j+1)) ,S _(i) ^((j+1)) ,S _(i)′^((j+1)) ,T _(i) ^((j+1)) ,T_(i)′^((j+1)) ,P _(i) ^((j+1)))

are calculated, and c_(i) ^((j)) is input to the output means 215.

Hash Value Encryption Processing by Hash Value Encryption Means 207

(S _(i) ^((j)) ,S _(i)′^((j)))=([r[2]_(i) ^((j)) ]X ^((j)) ,[r[2]_(i)^((j)) ]G+Ψ(Hash( K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c _(i) ^((j+1)) ,S_(i) ^((j+1)) ,S _(i)′^((j+1)) ,T _(i) ^((j+1)) ,T _(i)′^((j+1)) ,P _(i)^((j+1)))))

is calculated to input S_(i) ^((j)), S_(i)′^((j)) to the output means215.

Knowledge Concatenation Processing by Knowledge Concatenation Means 208

(T _(i) ^((j)) ,T _(i)′^((j)))=([r[3]_(i) ^((j)) ]X ^((j)) ,[r[3]_(i)^((j)) ]G+T′ ^((j+1)))

is calculated to input T_(i) ^((j)), T_(i)′^((j)) to the output means215.

Random Number Knowledge Proof Text Generation Processing by KnowledgeConcatenation Means 208

γ′_(i) ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i)^((j)) ,S _(i)′^((j)) ,T _(i) ^((j)) ,T _(i)′^((j)) ,[r[5]^((j)) ]X^((j)))

and

α′_(i) ^((j)) =r[5]_(i) ^((j))−γ′_(i) ^((j)) r[3]_(i) ^((j)) mod q

are calculated, and the results are input to the proof text collectionmeans 209.

Collection Processing of Secret Key Knowledge Proof Text and RandomNumber Knowledge Proof Text by Proof Text Collection Means 209

The secret key knowledge proof texts γ_(i) ^((j)) and α_(i) ^((j)) andthe random number knowledge proof texts γ′_(i) ^((j)) and α′_(i) ^((j))are collected to generate a proof text P_(i) ^((j))=[γ_(i) ^((j)), α_(i)^((j)), γ′_(i) ^((j)), α′_(i) ^((j))]. If j=(P_(i) ^((j)), it is outputas part of a proof text 212.

Processing by Proof Generation Means 210

The element r[4]_(i) ⁽⁰⁾ of Z/qZ is uniformly selected at random. Thefollowing entire random number knowledge proof is calculated, and P_(i)⁽⁰⁾ is output as part of the proof text.

γ′_(i) ⁽⁰⁾=Hash(K _(i) ⁽¹⁾ ,K _(i)′⁽¹⁾ ,c _(i) ⁽¹⁾ ,S _(i) ⁽¹⁾ ,S_(i)′⁽¹⁾ ,T _(i) ⁽¹⁾ ,T _(i)′⁽¹⁾ ,[r[4]_(i) ⁽⁰⁾ ]G)

α′_(i) ⁽⁰⁾ r=[4]_(i) ⁽⁰⁾−γ′_(i) ⁽⁰⁾ Σj=1m r[3]_(i) ^((j)) mod q

P_(i) ⁽⁰⁾=[γ′_(i) ⁽⁰⁾,α′_(i) ⁽⁰⁾]

Processing by Output Means 215

Data 214′ (K_(i) ^((j)), K_(i)′^((j)), c_(i) ^((j)), S_(i) ^((j)),S_(i)′^((j)), T_(i) ^((j)), T_(i)′^((j))) is generated from the inputsK_(i) ^((j)) and K_(i)′^((j)) from the key encryption means 205, theinput c_(i) ^((j)) from the data encryption means 206, the inputs S_(i)^((j)) and S_(i)′^((j)) from the hash value encryption means 207, andthe inputs T_(i) ^((j)) and T_(i)′^((j)) from the knowledgeconcatenation means 208. If j≠1, the data 214′ is fed back as the data214. If j=1, (K_(i) ⁽¹⁾, K_(i)′⁽¹⁾, c_(i) ^((j)), S_(i) ⁽¹⁾, S_(i)′⁽¹⁾,T_(i) ⁽¹⁾, T_(i)′⁽¹⁾) is output as the ciphertext 211.

That is, the participant apparatus 103 U_(i) sends the ciphertext 211(K_(i) ⁽¹⁾, K_(i)′⁽¹⁾, c_(i) ⁽¹⁾, S_(i) ⁽¹⁾, T_(i) ⁽¹⁾, T_(i)′⁽¹⁾) andthe proof text P_(i) ⁽¹⁾, P_(i) ⁽⁰⁾ to the consolidating apparatus 104of the consolidating organization.

[Ciphertext Verification by Consolidating Apparatus]

For i=1, . . . , n, the consolidating apparatus 104 verifies the prooftext for the entire data and confirms that

γ′_(i) ⁽⁰⁾=Hash(K _(i) ⁽¹⁾ ,K _(i)′⁽¹⁾ ,c _(i) ⁽¹⁾ , S _(i) ⁽¹⁾ ,S_(i)′⁽¹⁾,T_(i) ⁽¹⁾,T_(i)′⁽¹⁾,[α′_(i) ⁽⁰⁾ ]G _(i) ^((j))+[γ′_(i) ⁽⁰⁾ ]G)

holds.

The proof text for the entire data is sent to the verification apparatus109 (FIG. 1; processing 110). For only i for which it can be confirmedthat the proof text holds,

K_(i) ⁽¹⁾,K_(i)′⁽¹⁾,c_(i) ⁽¹⁾,S_(i) ⁽¹⁾,S_(i)′⁽¹⁾,T_(i)⁽¹⁾,T_(i)′⁽¹⁾,P_(i) ⁽¹⁾,P_(i) ⁽⁰⁾

is sent to the first substitution/decryption apparatus (processing 105).In the example shown in FIG. 1, five data are input, and four data areoutput. The number of ciphertexts decreases from this point. The numberafter the decrease is also represented by n. The ciphertexts areassigned numbers i=1 to n. In the following description,

K_(i) ^((j)),K_(i)′^((j)),c_(i) ^((j)),S_(i) ^((j)),S_(i)′^((j)),T_(i)^((j)),T_(i)′^((j)),P_(i) ^((j))

is generally different from the above-described value except when j=1.

[Shuffle and Decryption of Ciphertext by Substitution/DecryptionApparatus]

Sequentially for j=1, . . . , m, the substitution/decryption apparatus112 S^((j)) executes the following calculation and verification.

The substitution/decryption apparatus 112 S^((j)) receives the inputdata sequence 105 containing the encrypted secret key 302 (abbreviatedas a secret key ciphertext in FIG. 3) of secret key cryptography

K_(i) ^((j)),K_(i)′^((j))

the encrypted data 303 (abbreviated as a data ciphertext in FIG. 3)

c_(i) ^((j))

the encrypted hash value 304 (hash value ciphertext in FIG. 3)

S_(i) ^((j)),S_(i)′^((j))

the encrypted concatenated data 305 (abbreviated as a concatenated dataciphertext in FIG. 3)

T_(i) ^((j)),T_(i)′^((j))

and the secret key knowledge proof text 301 (abbreviated as a keyknowledge proof text in FIG. 3) and the secret random number knowledgeproof text 306 (abbreviated as a random number knowledge proof text inFIG. 3)

P_(i) ^((j))

The input data sequence 105 is divided into the elements 301 to 306 bythe data division means 322.

The substitution/decryption apparatus 112 S^((j)) executes the followingprocessing for all i (i=1, . . . , n).

The secret key knowledge verification means 307 confirms

γ_(i) ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i)^((j)) ,S _(i)′^((j)) ,T _(i) ^((j)) ,T _(i)′^((j)), [α_(i) ^((j)) ]X^((j))+[γ_(i) ^((j)) ]K _(i) ^((j)))

The secret random number knowledge verification means 308 confirms

γ′_(i) ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i)^((j)) ,S _(i) ^((j)) ,T _(i) ^((j)) ,T _(i)′^((j)),[α′_(i)^((j))]X^((j))+[γ′_(i) ^((j))]T_(i) ^((j)))

For i for which the equation does not hold, the data is not added to thefinal output data sequence.

The number of ciphertexts decreases here, too. The number after thedecrease is also represented by n. The ciphertexts are assigned numbersi=1 to n.

The secret key decryption means 310 inputs

E _(i) ^((j)) =K′ _(i) ^((j))−[1/x ^((j)) ]K _(i) ^((j))

to the data decryption means 313.

The data decryption means 313 calculates

$\begin{matrix}{e_{i}^{(j)} = {{\Phi \left( E_{i}^{(j)} \right)}\left( {K_{i}^{({j + 1})},K_{i}^{\prime {({j + 1})}},c_{i}^{({j + 1})},S_{i}^{({j + 1})},S_{i}^{\prime {({j + 1})}},T_{i}^{\prime {({j + 1})}},P_{i}^{({j + 1})}} \right)}} \\{= {{{dec}\left\lbrack e_{i}^{(j)} \right\rbrack}\left( c_{i}^{(j)} \right)}}\end{matrix}$

The hash value decryption means 312 calculates

H _(i) ^((j)) =S′ _(i) ^((j))−[1/x ^((j)) ]S _(i) ^((j))

The concatenated data decryption means 314 calculates

T′ _(i) ^((j+1)) =T′ _(i) ^((j))−[1/x ^((j)) ]T _(i) ^((j))

The obtained data sequence is

(K_(i) ^((j+1)),K_(i)′^((j+1)),c_(i) ^((j+1)),S_(i)^((j+1)),S_(i)′^((j+1)),T_(i)′^((j+1)),P_(i) ^((j+1)),H_(i)^((j)),T′_(i) ^((j+1))).

The substitution means 311 uniformly selects substitution π[j]( ) from[1, . . . , n] to [1, . . . , n] and executes the following substitutionprocessing.

K _(i) ^((j+1)) =Kπ[j](i)^((j+1))

K′ _(i) ^((j+1)) =K′π[j](i)^((j+1))

c _(i) ^((j+1)) =K′π[j](i)^((j+1))

S _(i) ^((j+1)) =Sπ[j](i)^((j+1))

S′ _(i) ^((j+1)) =S′π[j](i)^((j+1))

T′ _(i) ^((j+1)) =T′π[j](i)^((j+1))

P _(i) ^((j+1)) =Pπ[j](i)^((j+1))

H _(i) ^((j)) =Hπ[j](i)^((j))

T′ _(i) ^((j+1)) =T′π[j](i)^((j+1))

The hash value decryption authenticity proof means 315 generates a proof(hash value decryption authenticity proof text) to prove that H_(i)^((j)) is generated correctly.

The concatenated data decryption authenticity proof means 316 generatesa proof (concatenated data decryption authenticity proof text) to provethat T′_(i) ^((j+1)) is generated correctly.

The proof can be done by using, e.g., a method of reference “AnImplementation of a Universally Verifiable Electronic Voting Schemebased on Shuffling, Financial Cryptography 2002”.

For all i (i=1, . . . , m), the hash value verification means 317confirms that)

Φ(H _(i) ^((j)))=Hash(K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c _(i) ^((j+1)),S _(i) ^((j+1)) ,S _(i)′^((j+1)) ,T _(i) ^((j+1)) ,T _(i)′^((j+1)) ,P_(i) ^((j+1)))

holds. If i for which the equation does not hold is present, the hashvalue unacceptance authenticity proof means 318 clarifies π[j](i), E_(i)^((j)) (for i and generates a zero-knowledge proof (hash valueunacceptance authenticity proof text) to prove that E_(i) ^((j)) iscorrectly generated. The number of ciphertexts decreases here, too(processing 319). The number after the decrease is also represented byn. The ciphertexts are assigned numbers i=1 to n.

Finally, the output data sequence 107 (K_(i) ^((j+1)), K_(i)′^((j+1)),c_(i) ^((j+1)), S_(i) ^((j+1)), S_(i)′^((j+1)), T_(i) ^((j+1)), T′_(i)^((j+1)), P_(i) ^((j+1)), H_(i) ^((j))) is sent to the nextsubstitution/decryption apparatus S^((j+1)).

The hash value decryption authenticity proof text, concatenated datadecryption authenticity proof text, and the hash value unacceptanceauthenticity proof text are sent to the verification apparatus 109 asthe authenticity proof text 108.

When the processing is ended for all the substitution/decryptionapparatuses S^((j)) (j=1, . . . , m), a plaintext 111[M_(i)]_(i=1, . . . n) in which data are shuffled is obtained.

[Processing by Verification Apparatus]

The verification apparatus 109 of the verifier receives

the authenticity proof text 108 containing the hash value decryptionauthenticity proof text 401 (abbreviated as a hash value proof text inFIG. 4), concatenated data decryption authenticity proof text 403(abbreviated as a concatenation proof text in FIG. 4), and hash valueunacceptance authenticity proof text 400 (abbreviated as an unacceptanceproof text in FIG. 4),

the input data sequence 105,

the output data sequence 107, and

the entire random number knowledge proof text 110.

For all i, a verification means 500 for verifying the entire randomnumber knowledge proof text 110 confirms that

γ′_(i) ⁽⁰⁾=Hash(K _(i) ⁽¹⁾ ,K _(i)′⁽¹⁾ ,c _(i) ⁽¹⁾ ,S _(i)′⁽¹⁾ ,T _(i)⁽¹⁾ ,T _(i)′⁽¹⁾ ,[α′ _(i) ⁽⁰⁾ ]G _(i) ⁽¹⁾+[γ′_(i) ⁽⁰⁾ ]G)

holds.

For all j=1, . . . , m, the following calculation and verification aredone sequentially. For all i (i=1, . . . , n), the verification means402 for executing secret key knowledge verification processing confirms

γ_(i) ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i)^((j)) ,S _(i)′^((j)) ,T _(i) ,T _(i)′^((j)),[α_(i) ^((j)) ]X^((j))+[γ_(i) ^((j)) ]K _(i) ^((j)))

The verification means 404 for executing secret random number knowledgeverification processing confirms

γ′_(i) ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i)^((j)) ,S _(i)′^((j)) ,T _(i) ^((j)) ,T _(i)′^((j)) ,[α′ _(i) ^((j)) ]X^((j))+[γ′_(i) ^((j)) ]T _(i) ^((j)))

For only i for which the equation does not hold, the subsequentprocessing is not executed.

The verification means 406 for executing hash value decryptionauthenticity verification processing verifies that [H_(i)^((j))]_(j=1, . . . n) is correctly generated (a method corresponding toproof and, for example, the method of the above-described reference isused).

The verification means 407 for concatenated data decryption authenticityverification processing verifies that {T′_(i) ^((j+1))]_(j=1, . . . n)is correctly generated (a method corresponding to proof and, forexample, the method of the above-described reference is used).

For all i (i=1, . . . , n), the comparison means 408 for executing hashvalue coincidence verification processing confirms that

Φ(H _(i) ^((j)))=Hash(K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c _(i) ^((j+1)),S _(i) ^((j+1)) ,S _(i)′^((j+1)) ,T _(i) ^((j+1)) ,T _(i)′^((j+1)) ,P_(i) ^((j+1)))

holds. If i for which the equation does not hold is present, theverification means 409 for executing hash value unacceptanceauthenticity verification processing verifies that π[j](i), E_(i) ^((j))for i is clarified, and equation E_(i) ^((j)) is correctly generated andconfirms that c π[j](i)^((j)) is correctly decrypted.

The verification means 405 for executing authenticity determinationoutputs acceptance when, for all data for which both the verificationmeans 402 for executing secret key knowledge verification processing andthe verification means 404 for executing secret random number knowledgeverification processing output acceptance, both the verification means406 for executing hash value decryption authenticity verificationprocessing and the verification means 407 for executing concatenateddata decryption authenticity processing means 407 output acceptance, andthe comparison means 408 for executing hash value coincidenceverification processing outputs acceptance, or the comparison means 408for executing hash value coincidence verification processing outputsunacceptance while the verification means 409 for executing hash valueunacceptance authenticity verification processing outputs acceptance,and the output data sequence contains only data corresponding to theelements accepted by the secret key knowledge verification processing,secret random number knowledge verification processing, and hash valuecoincidence verification processing and all the data. Otherwise,unacceptance is output.

Second Embodiment 2.1

The outline of the second embodiment will be described with reference toFIGS. 1, 5, 6, and 7.

As shown in FIG. 1, a mix-net system according to this embodimentincludes a plurality of participant apparatuses 103, a consolidatingapparatus 104, a plurality to substitution/decryption apparatuses 112,and a verification apparatus 109. The participant apparatus 103 has anarrangement shown in FIG. 5, which is the same as the participantapparatus of the first embodiment except that the apparatus of thesecond embodiment has neither knowledge concatenation means 208 norrandom number knowledge proof means 210. The consolidating apparatus 104is also the same as that of the first embodiment.

[Substitution/Decryption Apparatus]

As shown in FIG. 6, the substitution/decryption apparatus 112 has a datadivision means 723, secret key knowledge verification means 707, secretkey decryption means 710, data decryption means 713, hash valuedecryption means 712, hash value verification means 717, output datasequence generation means 711, redundant data delete confirmation means720, hash value decryption authenticity proof means 715, hash valueunacceptance authenticity proof means 718, and output means.

The data division means 723 divides each element of an input datasequence 105 input from the consolidating apparatus 104 or anothersubstitution/decryption apparatus into a secret key 702 of secret keycryptography, which is encrypted by public key cryptography, data 703encrypted by secret key cryptography, a hash value 704 encrypted bypublic key cryptography, and a proof text 701 of knowledge of theencrypted secret key.

The output data sequence generation means 711 generates a data sequencewhich contains, as sequence elements, only output data for whichacceptance is output from all of the hash value verification means 717and secret key knowledge verification means 707 and which arecorresponding in a sense of being generated from the same element dataof the input data sequence 105. The output data sequence generationmeans 711 also uniformly shuffles the elements at random to form anoutput data sequence 107. When the elements of the output data sequence107 are redundant, and it is confirmed that the redundant data isdeleted by subsequent processing, the redundant data delete confirmationmeans 720 outputs acceptance. Otherwise, unacceptance is output.

When the decrypted concatenated data contained in each element of theoutput data sequence 107 is always data obtained by decrypting encryptedconcatenated data contained in a certain element of the input datasequence 105, and the hash value verification means 717 outputsunacceptance, the hash value unacceptance authenticity proof means 715generates a hash value unacceptance authenticity proof text which provesthat output of unacceptance is authentic. The output means creates anauthenticity proof text 108 from the hash value decryption authenticityproof text and hash value unacceptance authenticity proof text andoutputs the authenticity proof text 108 and the output data sequence 107output from the output data sequence generation means 711. The remainingcomponents are the same as in the substitution/decryption apparatus ofthe first embodiment.

[Verification Apparatus]

As shown in FIG. 7, the verification apparatus 109 has a secret keyknowledge verification means 802, hash value decryption authenticityverification means 806, hash value coincidence verification means 808,hash value unacceptance authenticity verification means 809, andauthenticity determination means 805.

For, of the elements of the input data sequence 105, all elementsaccepted by the secret key knowledge verification means 402, theauthenticity determination means 805 outputs acceptance if all thefollowing conditions are satisfied. Otherwise, unacceptance is output.

(A) The hash value decryption authenticity verification means 806outputs acceptance.(B) The hash value coincidence verification means 808 outputsacceptance, or the hash value coincidence verification means 808 outputsunacceptance while the hash value unacceptance authenticity verificationmeans 809 outputs acceptance.(C) The output data sequence 107 contains only data corresponding to theelements accepted by the secret key knowledge verification means 802 andhash value coincidence verification means 808 and all these data.

The remaining components are the same as in the verification apparatusof the first embodiment.

The operation of the mix-net system is the same as in the firstembodiment, and a description thereof will be omitted.

2.2 Detailed Example

The second embodiment will be described in detail with reference toFIGS. 1, 5, 6, and 7.

[Initial Setting]

An initial setting apparatus 100 determines and publishes a bit length Aof a plaintext, a safety variable L, a prime number q whose bit lengthis larger than L by 5, an elliptic curve C having the order q, a point Gon C, a cryptographic hash function Hash( ) having the output bit lengthL, secret key cryptography using a key with the length L, an encryptionfunction enc[e]( ) and decryption function dec[e] of the secret keycryptography, a function Ψ( ) from a bit sequence with L bits to a pointon C, and mapping Φ( ) from a point on C to a bit sequence with L bits.

[Initial Setting of Substitution/Decryption Apparatus]

All the substitution/decryption apparatuses S^((j)) (j=1, . . . , m)execute the next initial setting processing. An initial setting means721 (FIG. 6) in each of substitution/decryption apparatuses S^((j))uniformly selects a private key 106 x^((j))εZ/qZ at random and saves theprivate key in the substitution/decryption apparatus S^((j)). Inaddition, the initial setting means 721 generates and publishes a publickey 101 X^((j))=[x^((j))]G. The initial setting means 721 in eachsubstitution/decryption apparatus S^((j)) uniformly selects r^((j))εZ/qZat random and calculates

γ^((j))=Hash(G,[r ^((j)) ]X ^((j))) and

α^((j)) =r ^((j))−γ^((j)) r ^((j)) mod q

and publishes γ^((j)) and α^((j)) as a zero-knowledge proof text 722 ofknowledge of x^((j)).

[Ciphertext Generation of Participant Apparatus]

For i=1, . . . , n, a participant apparatus 103 U_(i) (FIG. 5)determines a plaintext 102 M_(i) having the bit length Λ. As first data614, each participant apparatus U_(i) 103 generates data containingc_(i) ^((m+1))=M_(i) and arbitrary data 603 (each containing arbitraryL-bit character strings K_(i) ^((m+1)), K_(i)′^((m+1)), S_(i) ^((m+1)),S_(i)′^((m+1)), and P_(i) ^((m+1))). In addition, for j=1, . . . , m, akey generation means 604 uniformly selects elements r[1]_(i) ^((j)),r[2]_(i) ^((j)), and r[3]_(i) ^((j)) of Z/qZ and a point E_(i) ^((j)) onC at random.

Then, a key encryption means 605, data encryption means 606, hash valueencryption means 607, and output means 615 execute following processing613 repeatedly in the order of j=m, (m−1), . . . , and 1.

As in the first embodiment, as the arbitrary character string, a randomnumber, a number unique to a session, or a date/time is sometimesselected. When a random number is used, the participant apparatus canconfirm the presence of its plaintext from the final decrypted text set.When a number unique to a session or a date/time is used, it can berecognized that a ciphertext used for another session is not reused.

Secret Key Encryption Processing by Key Encryption Means 605

To encrypt a secret key e_(i) ^((j)), the key encryption means 605obtains E_(i) ^((j)) which satisfies

e_(i) ^((j))=Φ(E_(i) ^((j)))

and calculates

(K _(i) ^((j)) ,K _(i)′^((j)))=([r[1]_(i) ^((j))]X^((j)) ,[r[1]_(i)^((j)) ]G+E _(i) ^((j)))

The calculation result K_(i) ^((j)), K_(i)′^((j)) is input to the outputmeans 615.

Secret Key Knowledge Proof Text Generation Processing by Key EncryptionMeans 605

γ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i) ^((j)),S _(i)′^((j)) ,[r[3]_(i) ^((j)) ]X ^((j))),

α_(i) ^((j)) =r[3]_(i) ^((j))−γ_(i) ^((j)) r[1]_(i) ^((j)) mod q, and

P _(i) ^((j))=[γ_(i) ^((j)),α_(i) ^((j))]

are calculated, and P_(i) ⁽¹⁾ and P_(i) ⁽⁰⁾ are sent to theconsolidating apparatus 104 as a secret key knowledge proof text 612.

Data Encryption Processing by Data Encryption Means 606

e_(i) ^((j))=Φ(E_(i) ^((j)))

and

c _(i) ^((j)) =enc[e _(i) ^((j))](K ₁ ^((j+1)) ,K _(i)′^((j+1)) ,c _(i)^((j+1)) ,S _(i) ^((j+1)) ,S _(i)′^((j+1)) ,P _(i) ^((j+1)))

are calculated, and c_(i) ^((j)) is input to the output means 215.

Hash Value Encryption Processing by Hash Value Encryption Means 607

(S _(i) ^((j)) ,S _(i)′^((j))=([r[2]_(i) ^((j)) ]X ^((j)) ,[r[2]_(i)^((j)) ]G+Ψ(Hash( K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c _(i) ^((j+1)) ,S_(i) ^((j+1)) ,S _(i)′^((j+1)) ,P _(i) ^((j+1)))))

is calculated to input S_(i) ^((j)), S_(i)′^((j)) is input to the outputmeans 615.

Processing by Output Means 615

Data 614′ (K_(i) ^((j)), K_(i)′^((j)), c_(i) ^((j)), S_(i) ^((j)),S_(i)′^((j))) is generated from the inputs K_(i) ^((j)) and K_(i)′^((j))from the key encryption means 205, the input c_(i) ^((j)) from the dataencryption means 206, and the inputs S_(i) ^((j)) and S_(i)′^((j)) fromthe hash value encryption means 207. If j≠1, the data 614′ is fed backas the data 614. If j=1, (K_(i) ⁽¹⁾, K_(i)′⁽¹⁾, c_(i) ⁽¹⁾, S_(i) ⁽¹⁾,S_(i)′⁽¹⁾) is output as a ciphertext 211.

That is, the participant apparatus 103 U_(i) sends the ciphertext 611(K_(i) ⁽¹⁾, K_(i)′⁽¹⁾, c_(i) ⁽¹⁾, S_(i) ⁽¹⁾, S_(i)′⁽¹⁾) and the prooftext P_(i) ⁽¹⁾, P_(i) ⁽⁰⁾ to the consolidating apparatus 104.

[Ciphertext Verification by Consolidating Apparatus]

The consolidating apparatus 104 consolidates data collected from theparticipant apparatuses and sends them to the firstsubstitution/decryption apparatus. K_(i) ^((j)), K_(i)′^((j)), c_(i)^((j)), S_(i) ^((j)), S_(i)′^((j)), P_(i) ^((j)) is generally differentfrom the above-described value except when j=1.

[Shuffle and Decryption of Ciphertext by Substitution/DecryptionApparatus]

Sequentially for j=1, . . . , m, the substitution/decryption apparatus112 S^((j)) executes the following calculation and verification.

The input data sequence 105 containing the encrypted secret key 702(abbreviated as a secret key ciphertext in FIG. 6) of secret keycryptography

K_(i) ^((j)),K_(i)′^((j))

the encrypted data 703 (abbreviated as a data ciphertext in FIG. 6)

c_(i) ^((j))

the encrypted hash value 704 (abbreviated as a hash value ciphertext inFIG. 6)

S_(i) ^((j)),S_(i)′^((j))

and the secret key knowledge proof text 701 (abbreviated as a keyknowledge proof text in FIG. 6)

P_(i) ^((j))

and

private key 106

x^((j))

is input. The input data sequence 105 is divided into the elements 701to 704 by the data division means 723.

The following processing is executed for all i (i=1, . . . , n).

The secret key knowledge verification means 707 confirms

γ_(i) ^((j))=Hash(K _(i) ^((j)) ,K _(i)′^((j)) ,c _(i) ^((j)) ,S _(i)^((j)) ,S _(i)′^((j)) ,[α _(i) ^((j)) ]X ^((j))+[γ_(i) ^((j)) ]K _(i)^((j)))

For i for which the equation does not hold, the data is not added to thefinal output data sequence (processing 709).

The number of ciphertexts decreases here. The number after the decreaseis also represented by n. The ciphertexts are assigned numbers i=1 to n.

The secret key decryption means 710 calculates E_(i) ^((j))=K′_(i)^((j))−[1/x^((j))]K_(i) ^((j)).

The data decryption means 313 calculates

$\begin{matrix}{e_{i}^{(j)} = {{\Phi \left( E_{i}^{(j)} \right)}\left( {K_{i}^{({j + 1})},K_{i}^{\prime {({j + 1})}},c_{i}^{({j + 1})},S_{i}^{({j + 1})},S_{i}^{\prime {({j + 1})}},P_{i}^{({j + 1})}} \right)}} \\{= {{{dec}\left\lbrack e_{i}^{(j)} \right\rbrack}\left( c_{i}^{(j)} \right)}}\end{matrix}$

The obtained data sequence is (K_(i) ^((j+1)), K_(i)′^((j+1)), c_(i)^((j+1)), S_(i) ^((j+1)), S_(i)′^((j+1)), P_(i) ^((j+1))).

The substitution means 711 uniformly selects substitution π[j]( ) from[1, . . . , n] to [1, . . . , n] and executes the following substitutionprocessing.

K _(i) ^((j+1)) =Kπ[j](i)^((j+1))

K′ _(i) ^((j+1)) =K′π[j](i)^((j+1))

c _(i) ^((j+1)) =cπ[j](i)^((j+1))

S _(i) ^((j+1)) =Sπ[j](i)^((j+1))

S′ _(i) ^((j+1)) =S′π[j](i)^((j+1))

P _(i) ^((j+1)) =Pπ[j](i)^((j+1))

The hash value decryption means 712 and substitution means 711 executeoperation given by

H _(i) ^((j)) =S′π[j](i)^((j))−[1/x ^((j)) ]Sπ[j](i)^((j))

The hash value decryption authenticity proof means 715 generates a proof(hash value decryption authenticity proof text) to prove that H_(i)^((j)) is generated correctly. For this proof, the method of theabove-described reference is used.

For all i (i=1, . . . , ), the hash value verification means 717confirms that

Φ(H _(i) ^((j)))=Hash(K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c _(i) ^((j+1)),S _(i) ^((j+1)) ,S _(i)′^((j+1)) ,P _(i) ^((j+1)))

holds.

If i for which the equation does not hold is present, the hash valueunacceptance authenticity proof means 718 clarifies π[j](i), E_(i)^((j)) for i and generates a zero-knowledge proof (hash valueunacceptance authenticity proof text) to prove that E_(i) ^((j)) iscorrectly generated.

The number of ciphertexts decreases here, too (processing 719). Thenumber after the decrease is also represented by n. The ciphertexts areassigned numbers i=1 to n.

The redundant data delete confirmation means 720 confirms that, for i=1,. . . n, the sets of (K_(i) ^((j+1)), K_(i)′^((j+1)), c_(i) ^((j+1)),S_(i) ^((j+1)), S_(i)′^((j+1)), P_(i) ^((j+1))) are not redundant. Ifredundant sets are present, sets except one are erased. The number ofciphertexts decreases here, too. The number after the decrease is alsorepresented by n. The ciphertexts are assigned numbers i=1 to n.

Finally, the output data sequence 107

K_(i) ^((j+1)),K_(i)′^((j+1)),c_(i) ^((j+1)),S_(i)^((j+1)),S_(i)′^((j+1)),P_(i) ^((j+1)),H_(i) ^((j))

is sent to the next substitution/decryption apparatus S^((j+1)).

The hash value decryption authenticity proof text and the hash valueunacceptance authenticity proof text are sent to the verificationapparatus 109 as the authenticity proof text 108.

When the processing is ended for all the substitution/decryptionapparatuses S^((j)) (j=1, . . . , m), a plaintext 111[M_(i)]_(i=1, . . . n) in which data are shuffled is obtained.

[Processing by Verification Apparatus]

The verification apparatus 109 receives the authenticity proof text 108containing a hash value decryption authenticity proof text 801(abbreviated as a hash value proof text in FIG. 7) and a hash valueunacceptance authenticity proof text 800 (abbreviated as an unacceptanceproof text in FIG. 7), the input data sequence 105, and the output datasequence 107.

For all j=1, . . . , m, the following calculation and verification aredone sequentially. For all i (i=1, . . . , n), the secret key knowledgeverification means 802 confirms

γ_(i) ^((j))=Hash(K_(i) ^((j)),K_(i)′^((j)),c_(i) ^((j)),S_(i)^((j)),S_(i)′^((j)),[α_(i) ^((j)) ]X ^((j))+[γ_(i) ^((j)) ]K _(i)^((j)))

For only i for which the equation does not hold, the subsequentprocessing is not executed.

The hash value decryption authenticity verification means 806 verifiesthat [H_(i) ^((j))]_(i=1, . . . n) is correctly generated (a methodcorresponding to proof and, for example, the method of theabove-described reference is used).

For all i (i=1, . . . , n), the comparison means 808 for executing hashvalue coincidence verification processing confirms that

Φ(H _(i) ^((j)))=Hash(K _(i) ^((j+1)) ,K _(i)′^((j+1)) ,c _(i) ^((j+1)),S _(i) ^((j+1)) ,S _(i)′^((j+1)) ,P _(i) ^((j+1)))

holds.

If i for which the equation does not hold is present, the hash valueunacceptance authenticity verification means 809 verifies that π[j](i),E_(i) ^((j)) for i is clarified, and equation E_(i) ^((j)) is correctlygenerated and confirms that cπ[j](i)^((j)) is correctly decrypted.

The verification means 805 for executing authenticity determinationoutputs acceptance when, for all data for which both secret keyknowledge verification processing and secret random number knowledgeverification processing output acceptance, both hash value decryptionauthenticity verification processing outputs acceptance while hash valuecoincidence verification processing outputs acceptance, or hash valuecoincidence verification processing outputs unacceptance while hashvalue unacceptance authenticity verification processing outputsacceptance, and the output data sequence contains only datacorresponding to the elements accepted by the secret key knowledgeverification processing, secret random number knowledge verificationprocessing, and hash value coincidence verification processing and allthe data except redundant sets in [K_(i) ^((j+1)), K_(i)′^((j+1)), c_(i)^((j+1)), S_(i) ^((j+1)), S_(i)′^((j+1)), P_(i) ^((j+1))]. Otherwise,unacceptance is output.

[Reason Why Present Invention is Effective]

To prove that the decryption and substitution dec [e_(i)^((j))](cπ[j](i)^((j))) of data by the substitution/decryption apparatusis authentic, that the hash value, dec[e_(i) ^((j))] (cπ[i](i)^((j))),and the decryption result of the ciphertext by the public key generatedby the participant apparatus 103 equal is proved. This proof processingis hash value decryption proof processing. That the proof processing isexecuted in an open verification enable form is the main reason why thepresent invention allows open verification.

However, the effect of the above-described proof is obtained only whenthe participant apparatus correctly generates a hash value ciphertext.The substitution/decryption apparatus must prove the authenticity of itsoperation without the above generation.

First, it is confirmed by hash value verification processing whether theparticipant apparatus has generated a hash value ciphertext by authenticprocessing. If no authentic processing is executed, it is proved by hashvalue unacceptance authenticity proof processing that the participantapparatus is unauthorized. With this processing, the authenticity ofprocessing of the substitution/decryption apparatus is proved.

However, the processing of the participant apparatus is sometimesunauthorized by illicit processing of another participant apparatus.That is, data of one participant apparatus is copied by anotherparticipant apparatus which generates appropriate data on the basis ofthe ciphertext. In this case, the substitution/decryption apparatusdecrypts the ciphertext of the participant apparatus and proves theauthenticity of the decryption because the participant apparatus isunauthentic. This proof may be an attack on the ciphertext of theparticipant apparatus.

If a participant apparatus illicitly processes its ciphertext, theattack occurs as a natural result. However, if the data is copied by athird party, this attack must be prevented. As a defensive measure,secret key knowledge proof processing is executed. With this processing,when an illicit ciphertext is created from the ciphertext of anotherperson, processing is rejected first by substitution/decryptionprocessing.

When the ciphertext of another person is copied and illicitly processed,processing is rejected by the substitution/decryption apparatus, asdescribed above. However, if the ciphertext is simply copied and usedwithout any particular processing, processing is not rejected by theabove-described method. If this is permitted, the copied ciphertext isdecrypted a plurality of number of times. When such a phenomenon occurs,the contents of the copied ciphertext can be known by finding aplurality of identical plaintexts from the finally decrypted plaintexts.Processing of preventing such an attack on privacy is the proofprocessing for concatenated data in the first embodiment or theprocessing of deleting redundant data in the second embodiment.

If concatenated data is not generated by the apparatus, proof cannot becreated finally. Hence, simple copy can be prevented. Deleting redundantdata corresponds to processing of directly deleting copied data.

The participant apparatus sometimes inputs a character string such as arandom number, a number unique to a session, or a date/time in additionto a plaintext. These values are decrypted finally. Various things canbe confirmed by using the decrypted character strings. For example, whena random number is used, the participant apparatus can confirm thepresence of its plaintext from the final decrypted text set. When anumber unique to a session or a date/time is input, it can be recognizedthat a ciphertext used for another session is not reused.

1-20. (canceled)
 21. An participant encryption apparatus, comprising: akey encryption unit that encrypts one secret key in a plurality ofsecret keys of secret key cryptography using one public key of aplurality of public keys, wherein each public key corresponds to one ofa plurality of substitution/decryption apparatuses; a data encryptionunit that encrypts given data using one secret key in the plurality ofsecret keys; a hash value encryption unit that calculates a hash valueof the given data by using a cryptographic hash function and encryptingthe hash value by one public key in the plurality of public keys; aprocessor that provides plaintext as a first input to said dataencryption unit and subsequently and repeatedly inputs data to said dataencryption unit, wherein the data is provided from preceding outputsfrom said data encryption unit, said key encryption unit, and said hashvalue encryption unit, wherein the processor inputs the plaintext anddata to said data encryption unit a number of times equal to the numberof substitution/decryption apparatuses; and a transmitter for outputtingencrypted data from said processor.
 22. The participant encryptionapparatus according to claim 21, wherein said key encryption unitfurther generates a proof text of knowledge of the encrypted one secretkey.
 23. The participant encryption apparatus according to claim 22,further comprising: a knowledge concatenation encrypting unit thatencrypts the given data by one public key in the plurality of publickeys and generates a proof text of knowledge of a secret random numberused for the encryption, wherein said processor inputs the plaintext asthe first input to said data encryption unit and repeatedly inputs, assubsequent inputs to said data encryption unit, preceding outputs fromsaid data encryption unit, said key encryption unit, said hash valueencryption unit, and said knowledge concatenation encryption unit,wherein the processor inputs the plaintext and data to said dataencryption unit a number of times equal to the number ofsubstitution/decryption apparatuses; and a total random number knowledgeproof unit that generates a proof text of knowledge of a sum of thesecret random numbers used to encrypt data by said knowledgeconcatenation encryption unit during the repeated inputs of datathereto.
 24. The participant apparatus according to claim 21, whereinsaid transmitter outputs, together with the data obtained by theprocessing of said repeat means, data to prove that the apparatus is anauthentic participant apparatus.
 25. A substitution/decryptionapparatus, comprising: a processor that divides an input data sequenceinto elements comprising a secret key of secret key cryptography that isencrypted by a public key, data encrypted by the secret key, and a hashvalue encrypted by the public key; a secret key decryption unit thatdecrypts the encrypted secret key using a private key corresponding tothe public key; a data decryption unit that decrypts the encrypted datausing the decrypted secret key to generate output data; a hash valuedecryption unit that outputs a decrypted hash value obtained bydecrypting the encrypted hash value using the private key; a hash valueverification unit that compares the decrypted hash value with agenerated hash value of the generated output data, wherein the hashvalue verification unit outputs a hash value acceptance if the decryptedhash value matches the generated hash value, or a hash valueunacceptance if the decrypted hash value does not match the generatedhash value; an output data sequence generator that generates an outputdata sequence that comprises, as sequence elements, only the output datafor which acceptance is output by said hash value verification unit whenprocessing the input data sequence comprising the encrypted data used togenerate the output data, wherein the sequence elements are uniformlyshuffled at random to form the output data sequence; a hash valuedecryption authenticity proof unit that generates a hash valuedecryption authenticity proof text that proves that the hash value ofeach element of the output data sequence is always a value obtained bydecrypting the encrypted hash value contained in a corresponding elementof the input data sequence; a hash value unacceptance authenticity proofunit that generates a hash value unacceptance authenticity proof textthat proves, when said hash value verification means outputsunacceptance, that unacceptance is authentic; and an authenticity prooftext unit that generates an authenticity proof text from the hash valuedecryption authenticity proof text and the hash value unacceptanceauthenticity proof text and outputs the authenticity proof text and theoutput data sequence.
 26. The substitution/decryption apparatusaccording to claim 25, wherein said processor further divides eachelement of the input data sequence into a secret key knowledge prooftext that proves knowledge of the encrypted secret key; wherein theapparatus further comprises a secret key knowledge verification unitthat verifies authenticity of the secret key knowledge proof text, andoutputs acceptance if the proof text is authentic, or outputsunacceptance if the proof text is unauthentic; and wherein said outputdata sequence generator generates a data sequence that comprises, assequence elements, only output data for which acceptance is output fromboth of said hash value verification unit and said secret key knowledgeverification unit when processing an input data sequence comprising thecorresponding secret key knowledge proof text and the encrypted dataused to generate the output data.
 27. The substitution/decryptionapparatus according to claim 26, wherein said processor further divideseach element of the input data sequence into concatenated data encryptedby a public key, and a proof text showing knowledge of a secret randomnumber, wherein the apparatus further comprises: a secret random numberknowledge verification unit that verifies the secret random numberknowledge proof text, and outputs acceptance if the proof text isauthentic, or outputs unacceptance if the proof text is unauthentic; anda concatenated data decryption unit that decrypts the encryptedconcatenated data using a private key corresponding to the public key;wherein said output data sequence generator generates an output datasequence that comprises, as sequence elements, only output data anddecrypted concatenated data for which acceptance is output from all ofsaid hash value verification unit, said secret key knowledgeverification unit, and said secret random number knowledge verificationunit when processing an input data sequence comprising the correspondingsecret key knowledge proof text, the encrypted concatenated data used togenerate the decrypted concatenated data, and the encrypted data used togenerate the output data, wherein the sequence elements are uniformlyshuffled at random to form the output data sequence; wherein theapparatus further comprises a concatenated data decryption authenticityproof unit that outputs a concatenated data decryption authenticityproof text that proves that decrypted concatenated data contained ineach element of the output data sequence is obtained by decryptingencrypted concatenated data contained in a corresponding element of theinput data sequence; and wherein said authenticity proof text unitfurther creates the authenticity proof text from the hash valuedecryption authenticity proof text, the concatenated data decryptionauthenticity proof text, and the hash value unacceptance authenticityproof text and outputs the authenticity proof text and the output datasequence output from said output data sequence generator.
 28. Thesubstitution/decryption apparatus according to claim 26, furthercomprising: a redundant data deletion unit that deletes identicalelements in the output data sequence by subsequent processing whileleaving one of the identical element to form new output data; whereinsaid hash value unacceptance authenticity proof unit further generates ahash value unacceptance authenticity proof text that proves that thedecrypted concatenated data contained in each element of the output datasequence is always data obtained by decrypting the encryptedconcatenated data contained in a corresponding element of the input datasequence, and wherein said hash value verification means outputsunacceptance, the output of unacceptance is authentic.
 29. Averification apparatus, comprising: a hash value decryption authenticityverification unit that verifies that a decrypted hash value contained ina hash value decryption authenticity proof text coincides with a hashvalue obtained by decrypting an encrypted hash value of a correspondingelement of an input data sequence, and if the hash values coincide, thehash value decryption authenticity verification unit outputs acceptance,and if the hash values are not one-to-one correspondence, the hash valuedecryption authenticity verification unit outputs unacceptance; a hashvalue coincidence verification unit that outputs acceptance when thedecrypted hash value coincides with a hash value of each element of anoutput data sequence, and if the hash values do not coincide, outputsunacceptance; a hash value unacceptance authenticity verification unitthat verifies a hash value unacceptance authenticity proof text, whichproves that an element of the elements of the input data sequence,comprising a hash value for which said hash value coincidenceverification unit outputs unacceptance, and outputs acceptance if theproof text is authentic, and outputs unacceptance if the proof text isunauthentic; and an authenticity determination unit that evaluates anelement of the input data sequence and outputs acceptance if said hashvalue decryption authenticity verification unit outputs acceptance whilesaid hash value coincidence verification means outputs acceptance, or ifsaid hash value coincidence verification means outputs unacceptancewhile said hash value unacceptance authenticity verification meansoutputs acceptance and if the output data sequence contains only datacorresponding to elements accepted by said hash value coincidenceverification unit, and otherwise outputs unacceptance.
 30. Theverification apparatus according to claim 29, further comprising: asecret key knowledge verification unit that verifies authenticity of asecret key knowledge proof text belonging to each element of the inputdata sequence, and outputs acceptance if the proof text is authentic,and outputs unacceptance if the proof text is unauthentic; wherein saidauthenticity determination unit further outputs acceptance, whenprocessing elements of the input data sequence that are accepted by saidsecret key knowledge verification unit, if said hash value decryptionauthenticity verification unit outputs acceptance while said hash valuecoincidence verification unit outputs acceptance, or if said hash valuecoincidence verification unit outputs unacceptance while said hash valueunacceptance authenticity verification unit outputs acceptance, and ifthe output data sequence contains only data corresponding to theelements accepted by said secret key knowledge verification unit andsaid hash value coincidence verification unit and all the data, andotherwise, outputs unacceptance.
 31. The verification apparatusaccording to claim 30, further comprising: a secret random numberknowledge verification unit that verifies authenticity of a secretrandom number knowledge proof text belonging to each element of theinput data sequence, and outputs acceptance if the proof text isauthentic, and outputs unacceptance if the proof text is unauthentic;and a concatenated data decryption authenticity verification unit thatverifies that decrypted concatenated data contained in each element ofthe output data sequence coincides with data obtained by decryptingencrypted concatenated data contained in a corresponding element of theinput data sequence, and outputs acceptance if the concatenated datacoincide and are in the one-to-one correspondence, and outputsunacceptance if the concatenated data are not in the one-to-onecorrespondence; wherein said authenticity determination unit outputsacceptance when processing elements of the input data sequence that areaccepted by both said secret key knowledge verification unit and saidsecret random number knowledge verification unit, if both said hashvalue decryption authenticity verification unit and said concatenateddata decryption authenticity verification unit output acceptance whilesaid hash value coincidence verification unit outputs acceptance, or ifsaid hash value coincidence verification unit outputs unacceptance whilesaid hash value unacceptance authenticity verification unit outputsacceptance, and if the output data sequence contains only datacorresponding to the elements accepted by said secret key knowledgeverification unit, said secret random number knowledge verificationunit, and said hash value coincidence verification unit and all thedata, and otherwise outputs unacceptance.
 32. The verification apparatusaccording to claim 30, further comprising: a redundant data deleteconfirmation unit that, when an element of the output data sequence areredundant, outputs acceptance when receiving confirmation thatsubsequent processing deletes the redundant element, and otherwiseoutputs unacceptance; wherein said authenticity determination unitoutputs acceptance when processing elements of the input data sequencethat are accepted by said secret key knowledge verification unit, ifsaid hash value decryption authenticity verification unit and saidredundant data delete confirmation unit outputs acceptance while saidhash value coincidence verification unit outputs acceptance, or if saidhash value coincidence verification unit outputs unacceptance while saidhash value unacceptance authenticity verification unit outputsacceptance, and if the output data sequence contains only datacorresponding to the elements accepted by said secret key knowledgeverification unit and said hash value coincidence verification unit andall the data, and otherwise outputs unacceptance.